Key points
- Collabora released version 26.4.303 on September 11 to fix CVE-2026-110447.
- The flaw allows unauthenticated command execution when the local server is down.
- Disabling the app is ineffective; it must be updated or removed entirely.
Administrators using Nextcloud must verify if they run the Collabora Online Built-in CODE Server app. If so, they need to update to version 26.4.303 or later immediately. This patch addresses CVE-2026-110447, a high-severity flaw that allowed attackers to execute commands on servers. The issue affects all versions prior to 26.4.303. Standalone Collabora servers are not impacted by this specific vulnerability.
In plain English
The flaw exists in a script that starts the local document server if it is not running. Attackers sent requests with hidden commands in the URL path. When the server was down, the script processed these requests as shell commands. This allowed attackers to plant web shells, which are files that let them run any command on the server. The attack works only when the local server is restarting, upgrading, or crashed.
The background
According to The Hacker News, three administrators reported the issue on GitHub. The first logged attack occurred on September 10. Collabora published an advisory on October 14, warning that turning off the app does not mitigate the risk. The app is intended for local testing or small teams, not production use. It runs the Collabora Online Development Edition directly on the Nextcloud server.
What changes now
Collabora fixed the issue in version 26.4.303. This update requires Nextcloud 30 or later. The vendor stated that disabling the app is not sufficient to avoid the problem. Administrators must upgrade to the fixed version or remove the app completely. A warning on the Nextcloud forum confirmed that installations using only the standard Nextcloud Office app are not affected by this flaw.
Who needs to act first
Teams should prioritize systems that expose the Nextcloud interface to the internet or untrusted networks. Check whether the built-in CODE app is installed on any production servers. If the app is present, back up the configuration before updating. Test the update in a non-production environment first to ensure compatibility with your Nextcloud version. If an immediate update is not possible, remove the app entirely rather than just disabling it, as disabling leaves the vulnerable scripts accessible.
What to do and how to stay safe: Nextcloud
- Verify if the Collabora Online Built-in CODE Server app is installed on your Nextcloud instance.
- Update the app to version 26.4.303 or later once the vendor provides the update.
- Remove the app completely if you do not need local document editing capabilities.
- Monitor server logs for unusual command execution attempts during maintenance windows.
Step-by-step guide: How Passkeys Work: The Cryptographic Mechanics Behind Passwordless Login
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does disabling the Collabora app fix the vulnerability?
No, Collabora stated that disabling the app is not sufficient; it must be updated or removed.
Are standalone Collabora servers affected by this flaw?
No, the advisory specifies that standalone Collabora Online servers are not affected.
What Nextcloud version is required for the fix?
The fixed version of the app requires Nextcloud 30 or later.
